fkie_cve-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

RHSA-2026:62515 — Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP1 release and security update

io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

Most recent entries from all

fkie_cve-2026-19651

RHSA-2026:62515 — Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP1 release and security update